topic Re: How to list of search results with a value > X in a specific search field in Splunk Search

How to list of search results with a value > X in a specific search field

alysea — Fri, 09 Aug 2019 12:22:27 GMT

Hello,

I have the following field:= message.msg:

msg: before send to xxx, payload = {"id":"abc123","userId":1,"currency":1,"amount":"-54"}

I would like to find all search results where amount is <= -50.
How is it possible to do so?

Please let me know if any further information is required.

Thanks in advance!

Re: How to list of search results with a value > X in a specific search field

richgalloway — Fri, 09 Aug 2019 14:33:05 GMT

Here's one way.

... | rex field=message "amount":"(?<amount>-?\d+)" | where amount < -50

Re: How to list of search results with a value > X in a specific search field

alysea — Fri, 09 Aug 2019 15:36:39 GMT

Thank you, I will try and let you know if it works out 🙂

Re: How to list of search results with a value > X in a specific search field

Sukisen1981 — Sun, 11 Aug 2019 16:06:41 GMT

hi @alysea
This json field will perhaps have the amount in the payload field. Please check your interesting fields , I think your json values are mapped to the field called 'payload' and not message. The regex by @richgalloway is correct.
Try this if the json values are coming in a field called 'payload'

|  rex field=payload "amount\"+\:+\"(?<amount>.*?)\"" 
|  where amount < -50

Re: How to list of search results with a value > X in a specific search field

woodcock — Sun, 11 Aug 2019 20:24:38 GMT

Like this:

| makeresults | eval "message.msg" = "msg: before send to xxx, payload = {\"id\":\"abc123\",\"userId\":1,\"currency\":1,\"amount\":\"-54\"}"

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| rename message.msg AS _raw
| rex mode=sed "s/^[^\{]+//"
| spath
| where amount<=-50

Re: How to list of search results with a value > X in a specific search field

alysea — Mon, 12 Aug 2019 07:33:28 GMT

Thank you for the help!